Partial Decryption Research Articles

Hierarchical Access Structure-based Scheme with Outsourcing and Revocation Mechanism for Cloud Environment

Ciphertext policy attribute-based encryption (CPABE) is one of the efficient implementations of encrypted access control scheme for cloud computing. Though multiple implementations of CPABE exist, there are some issues that need to be addressed, including efficient revocation approach, decryption time, storage cost etc. In this paper, an efficient scheme that incorporates a hierarchical access structure, outsourced decryption, as well as user and attribute revocation is presented. The hierarchical access structure is utilized to encrypt multiple data using one common access structure and makes the encryption process more efficient. The outsourcing server is used to perform partial decryption, so that all heavy computations are performed by this server and less overhead is incurred by the data user. The proposed framework also integrates the evaluation of trustworthiness of data users and service providers to ensure trusted and encrypted access control procedures. The paper also presents an analysis of the time required for performing different operations. Simulation results show that the proposed scheme outperforms the existing approaches.

An image encryption scheme based on chaotic system and compressed sensing for multiple application scenarios

In this paper, we propose a novel image encryption scheme based on a chaotic system and compressed sensing for multiple application scenarios. It is a dedicated scheme for JPEG format that makes full use of the characteristics of DCT data. The proposed scheme generates a key from a plain image with random noise, which is then used to generate the parameters needed in the scheme through using a new chaotic system structure. This structure employs data segmentation for the DCT data of a plain image and processes sparse data and non-sparse data separately: it permutes non-sparse data, and applies permutation and compressed sensing to sparse data. By merging the processed data and performing efficient confusion, we obtain the final encrypted data. The reverse operation is image decryption, and partial decryption can be performed quickly since sparse data is not required. Such partial decryption can be used for multiple applications, such as copyright protection platforms and machine learning based on private data. Simulation experiments and a performance analysis show that the key generation method and efficient confusion of our scheme can improve the security of image encryption. Furthermore, the data segmentation and reconstruction algorithm based on a cyclic matrix can greatly improve decryption efficiency.

Threshold Homomorphic Encryption From Provably Secure NTRU

Abstract Homomorphic Encryption (HE) supports computation on encrypted data without the need to decrypt, enabling secure outsourcing of computing to an untrusted cloud. Motivated by application scenarios where private information is offered by different data owners, Multi-Key Homomorphic Encryption (MKHE) and Threshold Homomorphic Encryption (ThHE) were proposed. Unlike MKHE, ThHE schemes do not require expensive ciphertext extension procedures and are therefore as efficient as their underlying single-key HE schemes. In this work, we propose a novel NTRU-type ThHE scheme which caters to the computation scenarios with pre-defined participants. In addition to inheriting the simplicity of NTRU scheme, our construction has no expensive relinearization and correspondingly no costly evaluation keys. Controlling noise to make it increase linearly and then using a wide key distribution, our scheme is immune to the subfield lattice attacks and its security follows from the hardness of the standard R-LWE problem. Finally, based on the {0,1}-linear secret sharing and noise flooding techniques, we design a single round distributed threshold decryption protocol, where the decryption is able to be completed even when only given a subset (say $t$-out-of-$k$) of partial decryptions. To the best of our knowledge, our construction is the first NTRU-type ThHE scheme.

Encrypted Speech Retrieval Scheme Based on Multiuser Searchable Encryption in Cloud Storage

In order to solve the problem of multiuser security sharing and privacy protection of the speech data in cloud storage and realize efficient encrypted speech retrieval, an encrypted speech retrieval scheme based on multiuser searchable encryption was proposed. Firstly, the ciphertext-policy attribute-based encryption (CP-ABE) and searchable encryption (SE) are combined to support a multiuser searchable speech encryption scheme, which achieves the encryption and fine-grained access control of the speech data. Secondly, the Mel frequency cepstral coefficient (MFCC) feature of the original speech that is used as the input of the long- and short-term memory network (LSTM) is extracted to perform the deep semantic feature extraction as the speech keywords. Finally, the speech keywords are encrypted to generate a secure index, bound together with the encrypted speech, and then stored in the cloud. During the user retrieving, the keywords of query speech are extracted by utilizing the trained LSTM to generate the search trapdoor of the user and then uploaded to the cloud server, and the Euclidean distance is used for matching the security index with the search trapdoor. In addition, a proxy server is introduced to execute the partial ciphertext decryption operations to reduce computation overhead and storage space. The theoretical analysis and experimental results show that the proposed scheme has higher security and retrieval accuracy and can realize the secure storage of the massive speech data and multiuser data sharing.

An Outsourced Decryption ABE Model using ECC in Internet of Things

Internet of Things (IoT) is a modern technology that is applicable almost everywhere nowadays. Everything is connected to the Internet in the modern digital era. IoT is a collection of things that are interconnected to share information. Devices connected to IoT networks have some limitations in performing heavy computational tasks because of the availability of less computational and battery power. Attribute Based Encryption (ABE) is a modern public-key cryptographic technique that provides privacy with access control. The bilinear map is an expensive operation that is used in most of the ABE schemes. Elliptic Curve Cryptography (ECC) is an alternative for bilinear pairing to reduce the computation of encryption and decryption in ABE schemes. The process of encryption and decryption of ABE is a heavy computational task for resource-constrained devices. In this paper, an outsourcing-based decryption of ABE using ECC is proposed to reduce the decryption overhead of devices that have limited computational resources. Our scheme divides the computation of the decryption of ABE into two stages: first, the partial decryption of ciphertext in the cloud server, and second, the final decryption of partially decrypted ciphertext by the data user to retrieve the original message. This scheme is secure against the malicious cloud server by adding a blinding factor into the secret to be shared. The blinding factor is shared with intended users through attribute authority. The experimental results demonstrate that our scheme can reduce the decryption complexity and save the computational time of devices, compared to the existing schemes. Thus the proposed scheme is applicable for lightweight devices used in IoT.

A Security-Mediated Encryption Scheme Based on ElGamal Variant

Boneh et al. introduced mediated RSA (mRSA) in 2001 in an attempt to achieve faster key revocation for medium-sized organizations via the involvement of a security mediator (SEM) as a semi-trusted third party to provide partial ciphertext decryption for the receiver. In this paper, a pairing-free security mediated encryption scheme based on an ElGamal variant is proposed. The scheme features a similar setting as in the mediated RSA but with a different underlying primitive. We show that the proposed security mediated encryption scheme is secure indistinguishably against chosen-ciphertext attack (IND-CCA) in the random oracle via the hardness assumption of the computational Diffie-Hellman (CDH) problem.

A Lightweight Attribute-Based Access Control Scheme for Intelligent Transportation System With Full Privacy Protection

The Intelligent Transportation System (ITS) provides more possibilities for the realization of smart cities by integrating the Internet of Things (IoT) and cloud computing. However, how to ensure security of IoT data stored in the cloud has become one of the biggest challenges at present. As a promising solution for realizing fine-grained access control, Ciphertext-Policy Attribute-Based Encryption (CP-ABE) can be used to ensure data security. However, the traditional CP-ABE schemes may leak privacy of ITS users. Moreover, due to their high computational overheads, the current privacy-preserving techniques are not suitable for IoT lightweight devices. To fill this gap, this article presents ABE-FPP, a lightweight attribute-based access control scheme with full privacy protection (FPP), which can achieve full privacy protection in the three key stages (i.e., key generation, access control, and partial decryption), while reducing consumption overhead on the user side. Specifically, to protect privacy during key generation, a lightweight two-party secure computing protocol between the user and the authority is designed to generate secret keys; to protect privacy during the access control policy setting, we present an efficient policy hidden strategy, which only reveals attribute names and efficiently hides attribute values; to protect privacy during partial decryption, we propose a hybrid authentication method that does not need to submit attribute values to the cloud. Moreover, to achieve lightweight computation for IoT devices, online/offline encryption and outsourced decryption are employed in ABE-FPP. Finally, formal security proofs show that our scheme is secure in the standard model. The asymptotic complexity analyses and experimental results demonstrate that the presented scheme achieves higher computation efficiency than the state-of-the-art ones.

Fully Constant-Size CP-ABE with Privacy-Preserving Outsourced Decryption for Lightweight Devices in Cloud-Assisted IoT

In recent years, ciphertext-policy attribute-based encryption (CP-ABE) has been recognized as a solution to the challenge of the information privacy and data confidentiality in cloud-assisted Internet-of-Things (IoT). Since the devices in cloud-assisted IoT are generally resource-constrained, the lightweight CP-ABE is more suitable for the cloud-assisted IoT. So how to construct the lightweight CP-ABE for the cloud-assisted IoT to achieve the fine-grained access control and ensure the privacy and confidentiality simultaneously is a prominent challenge. Thus, in this paper, we propose a constant-size CP-ABE scheme with outsourced decryption for the cloud-assisted IoT. In our scheme, the ciphertexts and the attribute-based private keys for users are both of constant size, which can alleviate the transmission overhead and reduce the occupied storage space. Our outsourced decryption algorithm is privacy-protective, which means the proxy server cannot know anything about the access policy of the ciphertext and the attributes set of the user during performing the online partial decryption algorithm. This will prevent the privacy from leaking out to the proxy server. And we rigorously prove that our scheme is selectively indistinguishably secure under the chosen ciphertext attacks (IND-CCA) in the random oracle model (ROM). Finally, by evaluating and implementing our scheme as well as other CP-ABE schemes, we can observe that our scheme is more suitable and applicable for cloud-assisted IoT.

Verifiable Multikeyword Search Encryption Scheme With Anonymous Key Generation for Medical Internet of Things

The development of the Internet of Things (IoT) has given birth to new applications and services. Accordingly, because the IoT application system collects a large amount of data containing sensitive information, there are also new challenges in data security and privacy preservation. To locate the medical IoT (mIoT), this article proposes a multikeyword searchable encryption scheme based on attributes supporting the data privacy preservation and integrity verification of the electronic health files stored on the IoT cloud platform on the basis of ensuring the application business functions of mIoT: 1) to ensure data confidentiality and fine-grained search authorization, the attribute-based encryption mechanism is introduced to encrypt the symmetric key. Moreover, anonymous key generation tampers semitrusted center authority’s (CA) decryption of all ciphertexts of users and access policy is hidden to prevent access policy from leaking; 2) the convergence key is adopted to encrypt electronic health records (EHRs), thereby providing double verification of the correctness of the search results and partial decryption results; 3) a time-division mechanism is also established to provide the access validity of shared EHRs; and 4) fixed length ciphertext and outsourcing decryption mechanisms are used to reduce the calculation on the user side, in which the majority of the decryption calculations are done by the cloud server. Formal proofs and performance evaluation show that the proposed scheme can achieve data security, keyword security, integrity verification, hidden policy, and collusion resistance, and has high computational efficiency and search efficiency.

Joint Image Encryption and Screen-Cam Robust Two Watermarking Scheme.

This paper proposes a joint encryption and screen-cam robust watermarking scheme. This method combines the advantages of smartphone, encryption and watermarking technologies, thereby achieving watermark extraction with a smartphone, partial decryption and tracking leakage from sneak shots. We design a dual watermarking algorithm to achieve watermark detection from both encrypted and decrypted images. First, a watermark is embedded in the discrete Fourier transform (DFT) domain to enable leakage tracking. Then, a second watermark is generated based on QR (Quick response) code encoding and inverse DFT to achieve high watermark capacity and error correction ability, where the secret key for decryption is included in the watermark message. By hiding this message carrying the watermark for the encrypted image in the changes caused by embedding the first watermark, we can improve imperceptibility and will not affect the effectiveness of the proposed scheme. Finally, to enhance the robustness of watermark after encryption, a chaotic mapping-based segment encryption algorithm is proposed. In the process of watermark detection, to cope with perspective correction, a frame locating based algorithm is employed to achieve watermark synchronization from a recaptured picture of the encrypted image. Considering the severe quality degradation, we use a noise component and local statistic feature-based method to extract the message bits. The experimental results show that the proposed scheme is secure, and highly robust, to screen-cam the process for both before and after decryption. Additionally, after decryption, the proposed scheme also has high robustness against common image processing attacks.

Multi-user Boolean searchable encryption supporting fast ranking in mobile clouds

Mobile cloud computing has become an important technology for mobile services. It overcomes physical limitations of mobile devices towards flexible and scalable mobile services. When using mobile clouds, people usually upload and store their data in cloud servers, and access the data through mobile devices from anywhere. As the privacy of the sensitive data is the major concern of users, the data is often encrypted before storing in cloud servers. However, the flexibility using the data is thereby affected, such as a Boolean search over the encrypted data, or ranking search results. To address these problems, in this paper we first propose a novel multi-user Boolean keyword search scheme (MBKSS) to achieve a rapid Boolean query outcome, while eliminating query interactions between users and the data owner. To rank search results and protect the privacy of relevance scores between files and keywords, we design a new homomorphic cryptosystem with partial decryption, which could be used as a basis for constructing a fast ranking search protocol (FRSP). A comprehensive security analysis shows that the proposed MBKSS and FRSP can achieve secure Boolean search and ranking. The experimental results demonstrate that the proposed MBKSS and FRSP are efficient and suitable for mobile devices.

Privacy Protection Scheme Based on CP-ABE in Crowdsourcing-IoT for Smart Ocean

Crowdsourcing is a novel distributed problem-solving mechanism that can provide the collection and share of marine data in the Internet of Things for the smart ocean. Nevertheless, the privacy leakage issue caused by multirole information interaction in crowdsourcing brings a serious challenge to the smart ocean. In this article, we propose a crowdsourcing privacy protection scheme based on multiauthority ciphertext-policy attribute-based encryption to enhance privacy protection in the data sharing environment. In this scheme, we design an independent key component distribution approach through multiple authorities, which could effectively disperse the security responsibility from the crowdsourcing platform. Then, we present the idea of partial decryption on the platform to reduce the computing cost of mobile users and prevent the platform from snooping on users’ data. Moreover, we put forward an efficient attribute revocation mechanism and a task search function in the scheme to achieve dynamic on-demand services while ensuring the forward and backward security of tasks. Theoretical analysis proves the correctness of both decryption and keywords matching, and the security of each involved entity. The simulation results show that our proposed scheme achieves a significant improvement in reducing time consumption compared with several related schemes.

Multimedia access control with secure provenance in fog-cloud computing networks

Multimedia data, ranging from text, audio, video to animation, undergoes intellectual property protection or has high sensitivity. To deal with privacy leakage during multimedia sharing and dissemination, it is crucial to trace the origin and transformation history of multimedia data, which is called multimedia provenance. In this paper, we construct a multimedia access control system with secure provenance in fog-cloud computing networks, which is designed based on attribute based encryption (ABE) and zero of knowledge technologies. The proposed scheme realizes confidentiality of multimedia big data that is outsourced to the cloud, anonymity of data provider, fine-grained access control of encrypted data, irrefutable of the provenance data, and traceability of data provider. We utilize the fog server to reduce user’s decryption burden and transfer partial decryption tasks. The suggested system is formally proved indistinguishable against chosen plaintext attack (IND-CPA). The simulation and experimental results indicate that our system has low communication overhead and low computation cost.

Multi-Authority Revocable Access Control Method Based on CP-ABE in NDN

For the future of the Internet, because information-centric network (ICN) have natural advantages in terms of content distribution, mobility, and security, it is regarded as a potential solution, or even the key, to solve many current problems. Named Data Network (NDN) is one of the research projects initiated by the United States for network architecture. NDN is a more popular project than ICN. The information cache in the NDN separates content from content publishers, but content security is threatened because of the lack of security controls. Therefore, a multi-authority revocable access control method based on CP-ABE needs to be proposed. This method constructs a proxy-assisted access control scheme, which can implement effective data access control in NDN networks, and the scheme has high security. Because of the partial decryption on the NDN node, the decryption burden of the consumer client in the solution is reduced, and effective user and attribute revocation is achieved, and forward security and backward security are ensured, and collusion attacks are prevented. Finally, through the other security and performance analysis of the scheme of this paper, it proves that the scheme is safe and efficient.

Efficient Decentralized Attribute Based Access Control for Mobile Clouds

Fine grained access control is a requirement for data stored in untrusted servers like clouds. Owing to the large volume of data, decentralized key management schemes are preferred over centralized ones. Often encryption and decryption are quite expensive and not practical when users access data from resource constrained devices. We propose a decentralized attribute based encryption (ABE) scheme with fast encryption, outsourced decryption and user revocation. Our scheme is very specific to the context of mobile cloud as the storage of encrypted data and the partial decryption of ciphertexts are dependent on the cloud and users with mobile devices can upload data to the cloud or access data from it by incurring very little cost for encryption and decryption respectively. The main idea is to divide the encryption into two phases, offline preprocessing phase which is done when the device is otherwise not in use and an online phase when the data is actually encrypted with the policy. This makes encryption faster and more efficient than existing decentralized ABE schemes. For decryption outsourcing, data users need to generate a transformed version of the decryption key allowing an untrusted proxy server to partially decrypt the ciphertext without gaining any information about the plaintext. Data users can then fully decrypt the partially decrypted ciphertext without performing any costly pairing operations. We also introduce user revocation in this scheme without incurring too much additional cost in the online phase. Comparison with other ABE schemes shows that our scheme significantly reduces computation times for both data owners and data users and highly suitable for use in mobile devices.

BDSS-FA: A Blockchain-Based Data Security Sharing Platform With Fine-Grained Access Control

Aiming at the problem of privacy leakage during data sharing in the Internet of Things, a blockchain based secure data sharing platform with fine-grained access control(BSDS-FA) is proposed. First, this paper proposes a new hierarchical attribute-based encryption algorithm, which uses hierarchical attribute structure and multi-level authorization center. The algorithm implements flexible and fine-grained access control by distributing different user attributes to different authorization centers. Then, it combined with the Fabric blockchain technology to solve the problem of huge decryption cost for users in the Internet of things. Smart contract in blockchain executes high-complexity partial decryption algorithm to reduce the users’ decryption overhead. Blockchain can also realize the traceability of historical operations to meet the security requirements of data restriction open and transparent supervision. Finally, the hierarchical attribute-based encryption algorithm is proved to be CPA-safe. The theoretical analysis and experimental results show that BDSS-FA provides more secure and reliable data sharing services for users in the Internet of Things.

How to Securely Collaborate on Data: Decentralized Threshold HE and Secure Key Update

Threshold homomorphic encryption (Threshold HE) schemes are modified homomorphic encryption schemes to be suitable for privacy-preserving data integration and analysis. In actual usage of it, one should take it care into consideration who manages secret keys. In Eurocrypt 2012, Asharov et al. proposed decentralized (n, n)-threshold HE schemes in bottom-up approach for which all n parties must allow by doing a partial decryption to decrypt successfully a ciphertext. To support more general threshold structure for HE, Boneh et al. presented (t, n)-threshold HE schemes using secret sharing schemes in top-down approach with a central key dealer. In this article, decentralized (t, n)-threshold HE schemes in bottom-up approach will be constructed. The decentralized (n, n)-threshold HE scheme is fisrt modified to reduce the error contained in the common evaluation key which affects to the entire parameter size. Then by applying (t, n)-threshold secret sharing scheme, (n, n)-threshold HE scheme is converted to (t, n)-threshold HE scheme. Moreover, proactive secret sharing scheme is applied to update secret key share of the constructed (t, n)-threshold HE scheme whenever needed.

Convolutional Neural Network Framework for Encrypted Image Classification in Cloud-Based ITS

Internet of Things (IoT) and Cloud Computing (CC) technologies are becoming critical requirements to the advancement of intelligent transportation systems (ITSs). ITSs generally rely on captured images to evaluate the status of traffic and perform vehicle statistics. However, such images may contain confidential information, and thus, securing such images is paramount. Therefore, we propose in this paper an efficient framework for improving the security of CC-IoT based ITSs. The proposed framework allows extracting particular vehicle information without revealing any sensitive information. Towards this goal, a convolutional neural network is used to classify encrypted images, based on the vehicle type in real-time, obtained by cameras integrated into road-side units that are part of an ITS leaving sensitive information in all images hidden. Within the proposed framework, we develop a new image classification architecture that never fully decrypts the captured images, thus protecting drivers' personal information, such as location, license plate, and vehicle contents. In addition, the system does not require a fully decrypted image, which increases the system computational efficiency as compared to conventional systems. The obtained results show that the proposed partial decryption classification technique presents up to 18% reduction in average computational complexity when compared with a fully decrypted system.

AuthCropper

As surveillance systems are popular, the privacy of the recorded video becomes more important. On the other hand, the authenticity of video images should be guaranteed when used as evidence in court. It is challenging to satisfy both (personal) privacy and authenticity of a video simultaneously, since the privacy requires modifications (e.g., partial deletions) of an original video image while the authenticity does not allow any modifications of the original image. This paper proposes a novel method to convert an encryption scheme to support partial decryption with a constant number of keys and construct a privacy-aware authentication scheme by combining with a signature scheme. The security of our proposed scheme is implied by the security of the underlying encryption and signature schemes. Experimental results show that the proposed scheme can handle the UHD video stream with more than 17 fps on a real embedded system, which validates the practicality of the proposed scheme.

Trustworthy Delegation Toward Securing Mobile Healthcare Cyber-Physical Systems

Attribute-based encryption (ABE) offers a promising solution for flexible access control over sensitive personal health records in a mobile healthcare system on top of a public cloud infrastructure. However, ABE cannot be simply applied to lightweight devices due to its substantial computation cost during decryption. This problem could be alleviated by delegating significant parts of the decryption operations to computationally powerful parties, such as cloud servers, but the correctness of the delegated computation would be at stake. Thus, previous works enabled users to validate the partial decryption by employing a cryptographic commitment or message authentication code (MAC). This paper demonstrates that the previous commitment or MAC-based schemes cannot support verifiability in the presence of potentially malevolent cloud servers. We propose two concrete attacks on previous commitment or MAC-based schemes. We propose an effective countermeasure scheme for securing resource-limited mobile healthcare systems and provide a rigorous security proof in the standard model, demonstrating that the proposed scheme is secure against our attacks. The experimental analysis shows that the proposed scheme provides the similar performance compared with the previous commitment-based schemes and outperforms the MAC-based scheme.